init_on_free=1 added as interim mitigation for CVE-2026-98432
Original title: CVE-2026-98432: init_on_free=1 as an additional interim mitigation
init_on_free=1 kernel boot parameter serves as additional mitigation for nftables and MPTCP issues.
nftables rule drops inbound TCP carrying IPv4 options and disables MPTCP. The almalinux blog does not mention init_on_free=1 kernel boot parameter but it is added here as interim mitigation for CVE-2026-98432.
Unconfirmed: The almalinux blog does not mention the init_on_free=1 kernel boot parameter.
- 1.enable init_on_free=1 kernel boot parameter
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |
From the original article
Posted by Rui Sousa on Oct 31 Hello, https://almalinux. org/blog/2026-10-30-cve-2026-98432/>) are an nftables rule dropping inbound TCP that carries IPv4 options and disabling MPTCP. They do not mention the init_on_free=1 kernel boot parameter....
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.